Thanks Stefano, that is exactly correct! File transfer happens in the following steps: 1) Shuttl will move the file from the colddb dir to a local tmp (defined via localArchiverDir in conf/archiver.xml) 2) Shuttl will then copy the file from localArchiverDir to a tmp area at the destination 3) When the transfer completes, it then will move the file from that area to the final destination 4) Files in the local tmp are deleted when transfers are successful This mechanism gives us the necessary reliability to handle crashes, network interruptions, etc. ... View more

For more info on Shuttl setup see: See: https://github.com/splunk/splunk-shuttl/wiki/Quickstart-Guide ... View more

Hadoop does not need to be installed on the Splunk Indexer. If the data is in S3, then you can use the standard ways of deploying Hadoop to operate on the data there. See a discussion here: http://stackoverflow.com/questions/4092852/i-cant-get-hadoop-to-start-using-amazon-ec2-s3 Also keep in mind that if you want to use the data in Hadoop, you will want to archive in CSV format. If you want the data to come back to Splunk, you can bring the CSV data back (however, it may incur compute load on import), or for more efficient index restoration, store in Splunk Bucket format. ... View more

A belated response that I'll answer for others on Splunkbase. To summarize: If you use S3 as your storage, setting up Hadoop to use the data is up to you. You can use Hadoop in EC2, or EMR. (keep in mind you need to archive in CSV format; only Splunk can understand the Splunk Bucket format) In order to setup Shuttl for Amazon S3, you provide a URI indicating the backend. Inside, $SPLUNK_HOME/etc/apps/shuttl/conf you'll see archiver.xml. In that file, you'll edit the archiverRootURI to have a value of the form: s3:// : @ / In addition, keep in mind that though "s3n" will work as well for Shuttl, you will need to keep in mind the limitation of file size. In general, it's safest to use "s3". See the Quickstart guide for more information: https://github.com/splunk/splunk-shuttl/wiki/Quickstart-Guide ... View more

Great Post! A couple of corrections during import (at least with 4.2.5): add the bucket dir in the import line, thus: /opt/splunk/var/lib/splunk/defaultdb/db/hot_v1_0 after restart, I didn't get prompted, perhaps there's a new fsck that happens automatically (you'll see in splunkd.log the recovery occur) ... View more

There will be an app that provides the option of doing lookup tables in MySQL rather than flat files to avoid the need to replicate the data via bundle replication. (which would be option 1, the post above) ... View more

Unsure how this applies to Oracle. ... View more

One way is to utilize CSV data format as the means by which to transfer data. You can select what you want via coming up with the search string that gets the dataset that you want to import to Oracle. Search results are tabular, so it can easily be imported to a table in oracle. You can then export to a csv file via the "outputcsv" command, for instance: ‘sourcetype=”samplesourcetype” SenderIP=”192.168.0.12” | outputcsv myoutputfile.csv’ (see: http://blogs.splunk.com/2009/08/07/help-i-cant-export-more-than-10000-events/) You can then import via SQL Loader into a table. (table creation, metadata mapping, etc. is left as an exercise to the user) Hope this helps! ... View more

This apparently is a bug in the new "js minification" feature in 4.2, which was implemented to improve web performance. In order to turn off this feature, create a web.conf in $SPLUNK_HOME/etc/system/local and you can use the following setting in web.conf [settings] minify_js = False minify_css = False The performance should be equivalent of 4.1.x ... View more

It's unlikely you want to use SocketAppender with Splunk, since it sends a serialized Java object, LoggingEvent, which is meant for something like SocketNode to receive and deserialize. Something that may have more sensible data is to use SyslogAppender. (though I haven't tried it personally) ... View more